CVE-2026-105811 - Authorization bypass through a user-controlled key in the Amazon Q Business Lambda hook sample in QnABot on AWS
AWS Lambda ยท 2026-10-07
Actions
Technical Details
| Affected Versions | 7.0.0, 7.4.5 |
|---|---|
| Regions | all |
| CVE IDs | CVE-2026-105811 |
| Migration Required | Yes |
| Cost Impact | Neutral |
| IaC Impact | High |
What This Means
For DevOps Teams
Update the QnABot on AWS stack to version 7.4.6 or later and redeploy the Amazon Q Business Lambda hook sample stack to address the authorization bypass vulnerability (CVE-2026-105811).
For Platform Teams
Deploy the updated QnABot on AWS stack and redeploy the Amazon Q Business Lambda hook sample to ensure the security patch is applied, reducing the risk of unauthorized access to S3 objects.
For Executives
Implement the security patch for QnABot on AWS to mitigate the risk of unauthorized access to Amazon S3 objects, ensuring customer data protection and maintaining trust.
Source
Related AWS Lambda Updates
- CVE-2026-104002: Fail-open error handling in the data masking utility in Powertools for AWS Lambda (Python) (2026-10-01)
- AWS Lambda durable functions are now available in AWS European Sovereign Cloud region (2026-09-24)
- AWS Lambda now supports direct read configuration for Amazon S3 Files (2026-09-11)
- AWS Lambda recursive loop detection is now available in Europe Sovereign Cloud (2026-09-10)
- AWS Lambda durable functions integrates with Pydantic AI (2026-09-10)